AMENDMENT UNDER 37 CF.R. 1.116- EXPEDITED PROCEDURE Page 8 

Serial Number: 09/746,205 Dkt: 884.336US1 (INTEL) 

Filing Date: December 22, 2000 
Title: PORT-BASED PACKET FILTER 

Assignee: Intel Corporation __ . . 



REMARKS 

This responds to the Office Action mailed on June 14, 2005. 

Claims 5, 9, 15, 19, and 25 are amended. No claims have been canceled or added. As a 
result, claims 2, 5, 9, 12-13, and 15-38 are now pending in this application. 

The amendments to the claims are fully supported by the specification as originally filed, 
and no new matter will be added by entry of the amendment. The amendments clarify the claims 
and are not intended to limit the scope of equivalents to which any claim element may be 
entitled. Applicant respectfully requests reconsideration of the above-identified application in 
view of the amendments above and the remarks that follow. 

Claim Objections 

Claims 5, 9, 15, 19 and 25 were objected to due to informalities. In particular, "the host" 
of each amended claim allegedly lacked clarity. While Applicant respectfully disagrees, for ease 
of prosecution, these claims have been amended accordingly. Specifically, these claims have 
been amended to recite "a host" instead. 

$ 703 Rejection of the Claims 
1. Claims 2. 3, 5, 9 and!2-30 were rejected under 35 USC § 103(a) as being unpatentable over 
Graham-Cumming. Jr., (U.S. 6,1 82,146) in view of McKaughan et al. (U.S. 5.802,305). 
This rejection is respectfully traversed. 

The Examiner has the burden under 35 U.S.C. §103 to establish a prima facie case of 
obviousness. In re Fine, 837 F.2d 1071, 1074, 5 USPQ2d 1596, 1598 (Fed. Cir.1988). As part of 
establishing a prima facie case of obviousness, the Examiner must show that some objective 
teaching in the prior art or some knowledge generally available to one of ordinary skill in the art 
would lead an individual to combine the relevant teaching of the references. Id. 

The court in Fine stated that: 

Obviousness is tested by "what the combined teaching of the references 
would have suggested to those of ordinary skill in the art." In re Keller, 642 F.2d 
' 413, 425, 208 USPQ 871, 878 (CCPA 1981)). But it "cannot be established by 
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combining the teachings of the prior art to produce the claimed invention, absent 
some teaching or suggestion supporting the combination." ACSHosp. Sys., 732 
F.2d at 1577, 221 USPQ at 933. And "teachings of references can be combined 
only if there is some suggestion or incentive to do so." 

Id. (emphasis in original). 

The M.P.E.P. adopts this line of reasoning, stating that 

"In order for the Examiner to establish a prima facie case of obviousness, 
three base criteria must be met. First, there must be some suggestion or 
motivation, either in the references themselves or in the knowledge generally 
available to one of ordinary skill in the art, to modify the reference or to combine 
reference teachings. Second, there must be a reasonable expectation of success. 
Finally, the prior art reference (or references when combined) must teach or 
suggest all the claim limitations. The teaching or suggestion to make the claimed 
combination and the reasonable expectation of success must both be found in the 
prior art, and not based on Applicant's disclosure. In re Vaeck, 947 F.2d 488, 20 
USPQ 2d 1438 (Fed.Cir. 1991))." M.P.E.P. §2142. (emphasis added.) 



No Motivation Found of Record to Combine References 

With regard to independent claim 2, the Examiner admits on page 4 of the Action that 
'Graham does not specifically disclose when there is a host application assigned to the port 
number; sending a wake-up message to a power-managed host computer. . . ' Instead the Action 
looks to McKaughan for sending a wake-up message to a power-managed host computer. The 
Action concludes on page 5 that it would have been obvious to one having ordinary skill in the 
art: 

". . .having the teachings of Graham and McKaughan before him at the time the 
invention was made, to modify the system and method disclosed by Graham to 
include power management as taught by McKaughan to obtain sending a wake-up 
to a power-managed host computer when there is a host application assigned to 
the port number. The teachings of McKaughan would suggest to one of ordinary 
skill that power supplied to the entire computer is not necessary to determine if a 
host application is associated to a port number of a packet. One of ordinary skill 
would modify Graham, based on McKaughan teachings, by supplying power to 
the devices needed by the packet analysis module until a determination of the 
packet is made. Specifically, power would only need to be supplied to the 
elements in figure 3. If the packet were to be passed on to the application a wake- 
up message would be sent to power up the computer so that it may be processed. 
One of ordinary skill would have made the modification to achieve power 
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conservation in a computer system in a network environment in view of the 
teachings of McKaughan." Action, page 5. 

Applicant respectfully disagrees. 

There is no indication in Graham that Graham is attempting to or desiring to reduce 
power consumption. In fact, even the Examiner states that Graham is "silent with respect to the 
power consumption aspect of his particular invention." Therefore, there is simply no indication 
in the Action that there is motivation in Graham to look to McKaughan to reduce power 
consumption (or to modify Graham to include a wake-up message or a power-managed 
computer). And thus, there is no motivation in the record to combine the references to arrive at 
the present claims. 

There must be evidence of record to suggest the combination. Applicant 
respectfully requests that the Examiner place a reference in the file that indicates 
motivation in Graham to look to McKaughan for motivation to reduce power 
consumption in Graham. In the alternative, Applicant requests that the Examiner place 
an affidavit of personal knowledge as to this motivation being gleaned only from 
knowledge which was within the level of ordinary skill at the time the claimed invention 
was made (and not from Applicant's disclosure). Absent such a reference or affidavit, 
the proposed combination is impermissible hindsight. 

Because obviousness may not be established using hindsight and may not be established 
in view of the teachings or suggestions of the Applicant, the Action does not demonstrate a 
suggestion or motivation to combine Graham and McKaughan. Therefore, the Office Action has 
not established a prima facie case of obviousness for independent claims 2, 12, and 23. Thus, 
because there is no motivation to combine the references, claims 2, 12, and 23 are patentable 
over these cited references. 

For the following additional reasons, there is no motivation or suggestion to combine 
Graham and McKaughan to arrive at the present claims: The claimed invention as a whole must 
be considered in an obviousness test; obviousness may not be found where a modification 
renders a device inoperable; and obviousness may not be established using hindsight. 
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Claimed Invention as a Whole Must be Considered in an Obviousness Test 

The test for obviousness under §103 must take into consideration the invention as a 
whole; that is, one must consider the particular problem solved by the combination of elements 
that define the invention. Interconnect Planning Corp. v. Feil, 11 A F.2d 1 132, 1 143, 227 USPQ 
. 543, 551 (Fed. Cir. 1985). A patentable invention may lie in the discovery of the source of a 
problem, even though the remedy may be obvious once the source of the problem is identified. 
MPEP §2141.02. (emphasis added.) This is part of the "subject matter as a whole" which 
should always be considered in determining the obviousness of an invention under 35 USC §103. 
In re Spinnoble f 405 F. 2d 578, 585, 160 USPQ 237, 243 (CCPA 1969). MPEP §2141.02. 

In determining the differences between the prior art and the claims, the question under 35 
U.S.C. 103 is not whether the differences themselves would have been obvious, but whether the 
claimed invention as a whole would have been obvious. Stratoflex, Inc. v. Aeroquip Corp., 713 
F.2d 1530, 218 USPQ 871 (Fed. Cir. 1983); Schenckv. Nortron Corp., 713 F.2d 782, 218 USPQ 
698 (Fed. Cir. 1983); Interconnect Planning Corp. v. Feil, 114 F.2d 1132, 1143, 227 USPQ 543, 
551 (Fed. Cir. 1985); MPEP § 2141.02. 

The Examiner must, as one of the inquiries pertinent to any obviousness inquiry 
under 35 U.S.C. §103, recognize and consider not only the similarities but also the 
critical differences between the claimed invention and the prior art. In re Bond, 910 F.2d 
831, 834, 15 USPQ2d 1566, 1568 (Fed. Cir. 1990), reh'g denied, 1990 U.S. App. LEXIS 
19971 (Fed. Cir. 1990). 

The Abstract of the Graham patent describes: 

"a packet analysis module which (sic) performs a two step verification of an 
application for a packet. In a first step, the packet analysis module applies the 
ports from a packet to the application-port mapping table to obtain a first 
application identifier. In a second, separate step, the packet analysis module 
applies identification logic to the packet to identify an application based on packet 
data. The second step may be used for each packet or only where the packet is not 
identified by the application-port mapping table." 

As shown and described within Graham, the computer 300 of Figure 4 analyzes packets. 
If an application identifier is not found, the analyzed packets are merely discarded or passed onto 
a default application. Figure 6 at 613, 621, 623, and Figure 7 at 723 and 717 of Graham. The 
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computer system of Graham may be exposed to hackers, because the packets of Graham are 
analyzed within the memory 303 of the computer 300, and because the packets may be passed to 
a default application, if there is no known application associated with the packet. Figure 4, 
element 623 of Figure 6, element 717 of Figure 7, and column 8, lines 25-38 of Graham. 

In contrast to Graham, Applicant's packet may be forwarded to the host computer after 
filtering to protect the host computer from hackers. In the present independent claims 2, 12, and 
23, the wake-up message is sent to the power-managed host computer "when there is a host 
application associated with the port number" (emphasis added). Further, as claimed in 
independent claim 2, "when there is not a host application associated with the port number," the 
packet is discarded. Generally, the packet may be discarded or rejected before the host computer 
may receive the packet so that the host computer may be protected from hackers. See, for 
instance, page 6, lines 16-18, and page 2, lines 15-24 of the present specification. 

The abstract of the McKaughan patent describes: 

"In a computer network including a plurality of interconnected computers, one of 
the computers being a sleeping computer in a power down state, the sleeping 
computer having a list of packets to listen for stored on a network interface card 
associated with the sleeping computer, a method of waking the sleeping computer 
from the computer network. An incoming packet of information is transmitted 
from one of the computers in the network to the sleeping computer. When the 
network interface card of the sleeping computer detects the incoming packet, it 
compares the incoming packet to the list of packets stored on the network 
interface card. If the incoming packet matches one of the packets in the list of 
packets stored on the network interface card, or if the incoming packet is directly 
addressed to the sleeping computer, then a signal is issued to wake the sleeping 
computer. Otherwise, the incoming packet is discarded and the sleeping 
computer is not awaken." 

Independent claims 2, 12, and 23 include determining whether there is a host application 
associated with the port number of the packet, as opposed to McKaughan, which merely refers to 
comparing "the incoming packet to the list of packets stored on the network interface card" 
(citing the Abstract of McKaughan). 

Therefore, each cited reference and Applicant are clearly attempting to solve 
different problems and therefore seek very different solutions. Accordingly, considering 
the claimed invention as a whole, there is clearly no suggestion or motivation in the cited 
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references or to those skilled in the art to send "a wake-up message to a host computer" 
as recited in each of the independent, presently-pending claims 2, 12, and 23. For this 
reason, claims 1,12 and 23 are patentable over these cited references. 



Obviousness May Not Be Found Where a Modification Renders a Device Inoperable 

Additionally, while it is true that it is the teachings, not the actual physical embodiments, 
of references that are considered in making an obvious determination under 35 USC §103 (In re 
Keller at 425), on the other hand, it is equally true that if the teachings of a prior art reference 
would lead one skilled in the art to make a modification which would render another prior art 
device inoperable, then such a modification would generally not be obvious. In re Gordon, 733 
F.2d 900, 902, 2212 USPA 1 125, 1 127 (Fed Cir. 1984). 

The addressable memory 303 of Graham includes the software product 304 (packet 
analysis module 100). Figure 4, and column 8, lines 25-38 of Graham. There is no evidence of 
record that Graham indicates that the network interface 306 includes (or can include) the 
software product 304. Clearly, Graham does not indicate operating the computer in a low power 
mode. 

McKaughan, on the other hand, refers to powering down the computer except for power 
to the network interface card, before analyzing packets. See 340 of Figure 3, and see Figure 4. 

Modifying the computer 300 of Graham as suggested by the Action would render the 
packet analysis module 100 of Graham inoperable. By powering down the computer 300 of 
Graham, the software product 304 would not have power and thus not be able to execute. Even 
if the network interface 306 of Graham was with power while the computer 300 was powered 
down, there is no demonstrated indication in a reference of record to modify the network 
interface 306 (i.e. the packet analysis module 100), such that the software product 304 would be 
moved to be included in the "powered" network interface 306. 

Page 12 of the Action states that "one of ordinary skill would readily recognize that 
Graham would be modified to have a network interface as taught by McKaughan in order in 
enjoy the advantages taught by McKaughan. Specifically, the software of Graham and any 
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necessary hardware would reside in a network interface card that would remain powered when 
the rest of the computer is powered down." 

Applicant respectfully disagrees and requests that the Examiner place a reference in the 
file that indicates motivation to modify the network interface 306 of Graham to include software 
and hardware as suggested in the Action. In the alternative, Applicant requests that the 
Examiner place an affidavit of personal knowledge as to this motivation being gleaned only from 
knowledge which was within the level of ordinary skill at the time the claimed invention was 
made (and not from Applicant's disclosure). Absent such a reference or affidavit, there is no 
motivation for the proposed modification of the network interface 306. Until evidence is made 
of record, there is simply no motivation for Graham to operate in low power to analyze packets. 

Because obviousness may not be established where a modification renders a device 
inoperable, the Action does not show that there is some suggestion or motivation to combine 
Graham and McKaughan. Therefore, the Office Action has not established a prima facie case of 
obviousness for independent claims 2, 12, and 23. Thus, because there is no motivation to 
combine the references, claims 2, 12, and 23 are patentable over these cited references. 

Obviousness May Not Be Established Using Hindsight 

The Examiner must avoid hindsight. In re Bond, 910 F.2d 831, 834, 15 USPQ2d 
1566, 1568 (Fed. Cir. 1990). "Obviousness may not be established using hindsight or in 
view of the teachings or suggestions of the inventor." Para-Ordnance Mfg., Inc. v. SGS 
Importers Int% Inc., 73 F.3d 1085, 1087, 37 USPQ2d 1237, 1239 (Fed. Cir. 1995), cert, 
denied, 117 S.Ct. 80 (1996) citing W.L. Gore&Assocs. v. GarlocK Inc., 721 F.2d 1540, 
1553, 220 USPQ 303, 312-13, cert, denied, 469 U.S. 851 (1984). 

Because the computer 300 of McKaughan refers to powering down the computer except 
for power to the network interface card, before analyzing packets, and because Graham is to be 
powered on to analyze the packets and simply can not operate in low power to analyze packets, 
the only way to combine Graham and McKaughan is through hindsight. 

Because obviousness may not be established using hindsight and may not be established 
in view of the teachings or suggestions of the Applicant, the Action does not show that there is 
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some suggestion or motivation to combine Graham and McKaughan. Therefore, the Office 
Action has not established a prima facie case of obviousness for independent claims 2, 12, and 
23. Thus, because there is no motivation to combine the references, claims 2, 12, and 23 are 
patentable over these cited references. 

Because of lack of motivation to combine Graham and McKaughan to arrive at the 
present claims, the rejection under 35 U.S.C. § 103(a) cannot stand. Applicant respectfully 
requests reconsideration and allowance of independent claims 2, 12, and 23. 

Claims 5, 9, 13, 15-22 and 24-30 depend from independent claims 2, 12, or 23 and 
incorporate all of the limitations therein, respectively. Claims 5, 9, 13, 15-22 and 24-30 are also 
asserted to be allowable for the reasons presented above, and Applicant respectfully requests 
notification of same. Applicant considers additional elements of claims 5, 9, 13, 15-22 and 24- 
30 to further distinguish over the cited references, and Applicant reserves the right to present 
arguments to this effect at a later date. 

2. Claims 31-38 were also rejected under 35 USC § 103(a) as being unpatentable over Novoa et 
al. (U.S. 6,493.824) in view of Graham-Cumming, Jr. ("Graham"). 

This rejection is respectfully traversed. 

Novoa recites: 

A secure system and method is provided for remotely waking a computer from a power 
down state. In one embodiment, a network interface card receives incoming data packets 
via a network connector. A control module is coupled to the network connector and is 
configured to search the incoming packets for a wake-up pattern. The control module also 
verifies that the packet's destination address matches the destination address of the 
network interface card. If the destination addresses match and a wake-up pattern is 
found, the control module decrypts an encrypted value from the incoming packet and 
compares the result to an expected value. A successful comparison causes the control 
module to assert a signal to wake up the host computer. Preferably, a standard 
public/private key pair encryption scheme is used, and the source of the data packet 
encrypts the expected value with a private key. All computers which may receive wake- 
up packets are provided with a public key with which to decrypt values contained in a 
security field of any wake-up packets. A successful decryption serves to certify that the 
wake-up packet was transmitted from an authorized source. For added security, the 
expected value and public/private keys may be changed on a regular basis, or even every 
time a valid wake-up packet is received. The new value may be provided in the wake-up 
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packet, to be stored by the network card for the next use. (emphasis added) Novoa, 
Abstract. 

For the following reasons, there is no motivation or suggestion to combine Novoa and 
Graham to arrive at the present claims: there is no motivation found in the record to combine the 
references as proposed, and the proposed modification of Novoa destroys the stated purpose of 
Novoa. 

No Motivation Found of Record to Combine References 

With regard to independent claim 33 and dependent claim 31, the Action states on pages 

8-9 that Graham refers to "dynamic ports are frequently used to provide security [and Graham's 

invention] further provides the advantage of improve accuracy in the detection and accounting of 

traffic data." The Action concludes that it would have been obvious: 

"to one having ordinary skill in the art, having the teachings of Novoa and 
Graham before them at the time the invention was made, to modify the second 
filter of Novoa to include the filter as taught by Graham. One of ordinary skill in 
the art would have been motivated to make the modification in order to improve 
the accuracy in the detection and accounting of traffic and accurately report and 
manage such traffic. Further, Graham suggests that such a filter would be useful 
for providing security in such a network system." 

Applicant respectfully disagrees. 

First, the statement that "Graham suggests that such a filter would be useful for providing 
security in such a network system" is not supported. There is nothing of record to suggest that 
"dynamic ports" is equivalent to identifying an application based on packet data. Applicant 
respectfully requests that the Examiner place a reference in the file that indicates such 
equivalency. In the alternative, Applicant requests that the Examiner place an affidavit of 
personal knowledge as to this equivalency being gleaned only from knowledge which was within 
the level of ordinary skill at the time the claimed invention was made (and not from Applicant's 
disclosure). Absent such a reference or affidavit, the asserted statement does not demonstrate 
motivation. 

Second, there is no demonstrated indication from the Action that Novoa is 
attempting to improve the accuracy in the detection and accounting of traffic and 
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accurately report and manage such traffic. Therefore, there is simply no indication in the 
Action of motivation in Novoa to look to Graham for a suggestion to combine the two 
references. Again, there must be evidence of record to suggest the combination. 
Applicant respectfully requests that the Examiner place a reference in the file that 
indicates motivation for Novoa to look to Graham for motivation to improve the accuracy 
in the detection and accounting of traffic and accurately report and manage such traffic in 
Novoa. In the alternative, Applicant requests that the Examiner place an affidavit of 
personal knowledge as to this motivation being gleaned only from knowledge which was 
within the level of ordinary skill at the time the claimed invention was made (and not 
from Applicant's disclosure). Absent such a reference or affidavit, the proposed 
combination is impermissible hindsight. 

Proposed Modification of Novoa Destroys Stated Purpose of Novoa 

If a proposed modification would render the prior art invention being modified 
unsatisfactory for its intended purpose, then there is no suggestion or motivation to make the 
proposed modification. In re Gordon, 733 F.2d 900, 221 USPQ 1 125 (Fed. Cir. 1984); MPEP 
§2143.01. 

The stated purpose of Novoa includes the folllowing: 

"it is desirable for a computer system in a power down state to be able to 
discriminate between authorized wake-up packets and unauthorized wake-up packets." 
Novoa, col. 4, lines 43-45. 

To ensure the packet originated from the authorized source, Novoa recites: 

"Preferably, the security field value has been encrypted by an authorized source's 
private key. In a standard public key/private key encryption scheme, this means that the 
message can only be correctly decrypted by using the corresponding public key. If in fact 
the authorized source is the only one in possession of the private key, successful 
decryption using the public key ensures that the packet originated from the authorized 
source." Novoa, col. 9, lines 35-42. 



The proposed combination destroys the stated purpose of Novoa. 



AMENDMENT UNDER 37 C.F.R. 1.1 16 - EXPEDITED PROCEDURE Page 18 

Serial Number: 09/746,205 Dkt: 884.336US1 (INTEL) 

Filing Date: December 22, 2000 

Title: PORT-BASED PACKET FILTER 

Assignee: Intel Corporation — 

The Examiner proposes to modify the second filter of Novoa ("second filter for security 
purposes [at] step 414, col. 9, lines 43-53" of Novoa) to include the "filter" as taught by Graham. 
This modification destroys the purpose of Novoa, which includes having an encryption scheme 
to discriminate between authorized wake-up packets and unauthorized wake-up packets. 

If the proposed modification modifies the "second filter" of Novoa to include the Graham 
"filter," this would destroy the stated purpose because Graham's "filter" does not discriminate 
between authorized wake-up packets and unauthorized wake-up packets. In fact, Graham 
identifies an application based on packet data using an application port mapping table. If, for 
example, the system of the proposed combination of Novoa and Graham received a packet 
associated with an installed universal application (assuming the packet made it through the "first 
filter"), the system would be woken up, and there would be no discrimination between 
authorized wake-up packets and unauthorized wake-up packets as taught by Novoa. 

Again, the Abstract of Novoa states: "If the destination addresses match and a wake-up 
pattern is found, the control module decrypts an encrypted value from the incoming packet and 
compares the result to an expected value ... A successful decryption serves to certify that the 
wake-up packet was transmitted from an authorized source. " 

There is no evidence of record to assert that identifying an associated application 
is an equivalent security measure to an encryption scheme to certify that a wake-up 
packet was transmitted from an authorized source, and thus would not destroy the 
purpose of Novoa. Applicant respectfully requests that the Examiner place a reference in 
the file that indicates such equivalency. In the alternative, Applicant requests that the 
Examiner place an affidavit of personal knowledge as to this equivalency being gleaned 
only from knowledge which was within the level of ordinary skill at the time the claimed 
invention was made (and not from Applicant's disclosure). Absent such a reference or 
affidavit, the proposed combination destroys the purpose of Novoa, and is thus 
impermissible. 

Because obviousness may not be established without motivation to combine the 
references and the proposed modification would destroy the stated purpose of Novoa, the Action 
has not established a prima facie case of obviousness for independent claims 33 and 36. The 
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rejection under 35 U.S.C. § 103(a) cannot stand. Thus, because there is no motivation to 
combine the references, claims 33 and 36 are patentable over these cited references. 

Claims 31, 32, 34, 35, 37, 38 depend from independent claims 2, 33 or 36 and incorporate 
all of the limitations therein, respectively. Claims 31, 32, 34, 35, 37, 38 are also asserted to be 
allowable for the reasons presented above, and Applicant respectfully requests notification of 
same. Applicant considers additional elements of claims 31, 32, 34, 35, 37, 38 to further 
distinguish over the cited references, and Applicant reserves the right to present arguments to 
this effect at a later date. 



4 
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Conclusion 

Applicant respectfully submits that the claims are in condition for allowance and 
notification to that effect is earnestly requested. The Examiner is invited to telephone 
Applicant's attorney, Lucinda Price (located in Gainesville, Florida), at (352) 373-8804, or 
Applicant's below-named representative (located in Minneapolis, Minnesota), if prosecution will 
be assisted thereby. 

If necessary, please charge any additional fees or credit overpayment to Deposit Account 
No. 19-0743. 

Respectfully submitted, 
CHARLES L. BRABENAC 
By his Representatives, 

SCHWEGMAN, LUNDBERG, WOESSNER & KLUTH, P.A. 
Attorneys for Intel Corporation 
P.O. Box 2938 

Minneapolis, Minnesota 55402 
(612)349-9592 

Date U^a . 15 c2jDo5 By QoW^/rf- Y^^CLlx)^. 

Ann M. McCrackin 
Reg. No. 42,858 
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